A vulnerability exists in the preview5.php script of SourceCodester Class and Exam Timetabling System that allows an attacker to inject arbitrary SQL commands via the course_year_section parameter. This flaw is a combination of insecure handling of input (CWE-74) and classic SQL injection (CWE-89). If triggered, an attacker can read, alter, or delete data stored in the underlying database and potentially gain broader control over the application data layer, leading to confidentiality and integrity compromise.

The affected product is SourceCodester Class and Exam Timetabling System, version 1.0. The flaw resides in the preview5.php page, which is publicly accessible and part of the default system installation. No other vendors or products are currently reported to be impacted.

The CVSS score of 6.9 denotes moderate to high severity, and the publicly available exploit indicates that the attack can be carried out remotely without special prerequisites. Although the EPSS score is not disclosed, the lack of a KEV listing does not diminish the likelihood of exploitation; attackers often target exposed SQL injection points. In a typical scenario, a remote attacker can easily submit a crafted request and extract sensitive information or modify database records, posing a significant risk to businesses relying on this platform.